数据加工，从一个数据库加工成字段保存到另一个数据库：
*
| parse-regexp content, '^(\w{3}\s+\d{1,2}\s\d{2}:\d{2}:\d{2})\s+(\S+)\s+(.*)$' as sys_time, fw_ip, temp_content
| parse-regexp temp_content, 'date=([^\s]+)' as date
| parse-regexp temp_content, 'time=([^\s]+)' as time
| parse-regexp temp_content, 'devname="([^"]+)"' as devname
| parse-regexp temp_content, 'devid="([^"]+)"' as devid
| parse-regexp temp_content, 'logid="([^"]+)"' as logid
| parse-regexp temp_content, 'type="([^"]+)"' as type
| parse-regexp temp_content, 'subtype="([^"]+)"' as subtype
| parse-regexp temp_content, 'level="([^"]+)"' as level
| parse-regexp temp_content, 'srcip=([^\s"]+)' as srcip
| parse-regexp temp_content, 'srcport=([^\s"]+)' as srcport
| parse-regexp temp_content, 'dstip=([^\s"]+)' as dstip
| parse-regexp temp_content, 'dstport=([^\s"]+)' as dstport
| parse-regexp temp_content, 'proto=([^\s"]+)' as proto
| parse-regexp temp_content, 'action="([^"]+)"' as action
| parse-regexp temp_content, 'sessionid=([^\s"]+)' as sessionid
| parse-regexp temp_content, 'policyid=([^\s"]+)' as policyid
| parse-regexp temp_content, 'service="([^"]+)"' as service
| parse-regexp temp_content, 'duration=([^\s"]+)' as duration
| parse-regexp temp_content, 'sentbyte=([^\s"]+)' as sentbyte
| parse-regexp temp_content, 'rcvdbyte=([^\s"]+)' as rcvdbyte
| parse-regexp temp_content, 'msg="([^"]+)"' as msg
| extend event_time_standard = concat(date, ' ', time)
| parse-regexp event_time_standard, '(\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2})' as event_timestamp